Linux nfsd: any authenticated NFSv4.2 client can cancel and free another client's copy-notify stateid

Impact

On the OFFLOAD_CANCEL path, manage_cpntf_state() freed the target copy-notify state without checking which client created it. The lookup key si_opaque.so_id is allocated cyclically and therefore guessable, and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so one authenticated NFSv4.2 client can guess and destroy another client's server-side-copy state. On a shared training cluster where one kernel NFS server exports scratch or dataset volumes to many tenants, this is a cross-tenant reach: a tenant can abort other tenants' server-side copies, and the unchecked free is state-teardown driven by an untrusted identity. The fix compares state->cp_p_clid against the requesting client's cl_clientid and returns nfserr_bad_stateid on mismatch.

Who can reach it

Any client that can mount the export and authenticate as an NFSv4.2 client. No privilege on the server is needed, and no valid knowledge of the victim's stateid beyond guessing a cyclically-allocated id.

What to do

Patch the NFS server's kernel to a stable release carrying the ownership check and reboot the server node. Client GPU nodes need nothing. This is a storage-server reboot, not a fleet-wide drain, but it interrupts every mount unless the server is HA-paired. No mitigation short of disabling NFSv4.2 server-side copy is named in the record.

References

Related entries

• Linux nfsd: unprivileged netlink dump leaks 8 bytes of rq_flags and truncates IPv6 client addressesCVE-2026-89698 · Linux kernel nfsd (NFSD_CMD_RPC_STATUS_GET netlink, nfsd_genl_rqstp)Unscored
• Linux nfsd: NFSD_A_SOCK_ADDR has no minimum length, giving a 12-byte out-of-bounds read in listener_setCVE-2026-89700 · Linux kernel nfsd (nfsd_nl_listener_set_doit, NFSD_A_SOCK_ADDR netlink policy)Unscored
• Linux nfsd: TIME_DELEG decode paths accept out-of-range nseconds and propagate a malformed timespec to diskCVE-2026-89701 · Linux kernel nfsd (TIME_DELEG_ACCESS/TIME_DELEG_MODIFY nseconds decode)Unscored
• Linux NFS client: every failed NFSv4 mount leaks 4 KiB of unreclaimable slabCVE-2026-89714 · Linux kernel NFS client (nfs4_server_common_setup delegation hash table)Unscored
• Linux NFS localio: reference leak on nfs_uuid_add_file failure pins an nfsd_file and blocks netns teardownCVE-2026-89715 · Linux kernel NFS localio (nfs_open_local_fh error path, nfs_uuid_add_file)Unscored
• KVM arm64 vGICv2: guest write of an out-of-range GICV_DIR INTID triggers a host WARN and panics panic_on_warn hostsCVE-2026-89727 · Linux kernel KVM arm64 vGICv2 (GICV_DIR INTID handling)Unscored